2e6f6161de2504487282fd2dc5cae260eb7a7b73a651de65f0292e4f28e53067

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/09/2026, 05:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_2e6f6161de2504487282fd2dc5cae260eb7a7b73a651de65f0292e4f28e53067.html
Size 86KB
Sample260913-gpb6rasdlf
SHA256 2e6f6161de2504487282fd2dc5cae260eb7a7b73a651de65f0292e4f28e53067
MD5 1f26df8cf291ed4cedccc742d3d66f6e
SHA1 03e02f97690232b867dfb6becba30b1286b6c559
SHA512 600cc8f27477ee400c222e3f4cdbb8c64b5d6287f0177e9086aee727f92ae9fb4af3db9c77a3f825ab6bd816082e8acea28e892b58d135e76780ab79e21f967e
SSDEEP 1536:bd4QG39w3T9bNRn3sjHBQA5OWTQT5EmSQTj5IsUt8A7JG:bgWGQhTq2
TLSH
T1BD83B61712101CBAEE1705E1A4556B4E3BAE533BF0031079E2FC1FE63BDACE9951A16B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4372	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134337891910246132"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{A97ADC76-270C-4A6E-A18B-772436A87887}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3060	msedge.exe
3060	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 4784	4364	msedge.exe	87
PID 4364 wrote to memory of 4372	4364	msedge.exe	89
PID 4364 wrote to memory of 1168	4364	msedge.exe	90
PID 4364 wrote to memory of 1168	4364	msedge.exe	90
PID 4364 wrote to memory of 1168	4364	msedge.exe	90
PID 4364 wrote to memory of 1912	4364	msedge.exe	91
PID 4364 wrote to memory of 1912	4364	msedge.exe	91
PID 4364 wrote to memory of 5008	4364	msedge.exe	93
PID 4364 wrote to memory of 5008	4364	msedge.exe	93
PID 4364 wrote to memory of 5008	4364	msedge.exe	93
PID 4364 wrote to memory of 2080	4364	msedge.exe	94
PID 4364 wrote to memory of 2080	4364	msedge.exe	94
PID 4364 wrote to memory of 2080	4364	msedge.exe	94
PID 4364 wrote to memory of 1496	4364	msedge.exe	95
PID 4364 wrote to memory of 1496	4364	msedge.exe	95
PID 4364 wrote to memory of 1496	4364	msedge.exe	95
PID 4364 wrote to memory of 3884	4364	msedge.exe	96
PID 4364 wrote to memory of 3884	4364	msedge.exe	96
PID 4364 wrote to memory of 3884	4364	msedge.exe	96
PID 4364 wrote to memory of 3208	4364	msedge.exe	98
PID 4364 wrote to memory of 3208	4364	msedge.exe	98
PID 4364 wrote to memory of 948	4364	msedge.exe	99
PID 4364 wrote to memory of 948	4364	msedge.exe	99
PID 4364 wrote to memory of 4992	4364	msedge.exe	101
PID 4364 wrote to memory of 3628	4364	msedge.exe	106
PID 4364 wrote to memory of 1448	4364	msedge.exe	107
PID 4364 wrote to memory of 3816	4364	msedge.exe	108
PID 4364 wrote to memory of 4812	4364	msedge.exe	109
PID 4364 wrote to memory of 4812	4364	msedge.exe	109
PID 4364 wrote to memory of 3868	4364	msedge.exe	110
PID 4364 wrote to memory of 3868	4364	msedge.exe	110
PID 4364 wrote to memory of 3060	4364	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\jaffacakes118_2e6f6161de2504487282fd2dc5cae260eb7a7b73a651de65f0292e4f28e53067.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffc7cc1c188,0x7ffc7cc1c194,0x7ffc7cc1c1a0
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,14358182787710709038,10094380388296819890,524288 --field-trial-handle=2324,i,12620589476718200521,5632756738271971638,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,4903158112464893329,11276000623252014007,262144 --field-trial-handle=2324,i,12620589476718200521,5632756738271971638,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2228,i,2329385093108100425,6823809597009155808,524288 --field-trial-handle=2324,i,12620589476718200521,5632756738271971638,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:8
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,12653149097278944922,3083042263648909413,2097152 --field-trial-handle=2324,i,12620589476718200521,5632756738271971638,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,10947646962462638349,15886933280476961047,2097152 --field-trial-handle=2324,i,12620589476718200521,5632756738271971638,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,9488025454463912848,2746794803746516559,2097152 --field-trial-handle=2324,i,12620589476718200521,5632756738271971638,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:1
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,1699317249024485254,11009140881479139719,2097152 --field-trial-handle=2324,i,12620589476718200521,5632756738271971638,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:2
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,2631700903694138351,6833507935630530642,524288 --field-trial-handle=2324,i,12620589476718200521,5632756738271971638,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,7474616375355193684,1973904597489613425,524288 --field-trial-handle=2324,i,12620589476718200521,5632756738271971638,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,1776991657065777421,16884167737316741770,524288 --field-trial-handle=2324,i,12620589476718200521,5632756738271971638,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,1776991657065777421,16884167737316741770,524288 --field-trial-handle=2324,i,12620589476718200521,5632756738271971638,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,18409451902464344996,2343397912553278159,524288 --field-trial-handle=2324,i,12620589476718200521,5632756738271971638,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:8
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,6998567796916173160,2104156714846150279,524288 --field-trial-handle=2324,i,12620589476718200521,5632756738271971638,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:8
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,1995781949963310221,4225706055961742473,524288 --field-trial-handle=2324,i,12620589476718200521,5632756738271971638,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:8
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,704508963580947153,10906811561506833576,524288 --field-trial-handle=2324,i,12620589476718200521,5632756738271971638,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:8
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,7082480604647665684,4567923887384826375,524288 --field-trial-handle=2324,i,12620589476718200521,5632756738271971638,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:8
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6160,i,13025659203686785695,2626698008701508827,262144 --field-trial-handle=2324,i,12620589476718200521,5632756738271971638,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3060

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a62a1faeaaa56a5f5375b4d4921e6b263c0bc10a5ecc1f991894c66c32a88aef
MD5 64fcd85513a139bcf5844ab49aea8206
SHA1 3c834eccb77da48c4abac17c440971305fd9b653
SHA512 cd1b39ff43d56158fbb01c5408a5bf247d5bd82279b205a914ab4cdccfece77a5399e430bb26db6f7d10e70dc3503c3bf37c5de59e23cb8f62d6337066c4114f
TLSH
T15DD02232EBF00E82C00B0032082282880F08C03C08003222A23C20AE3A80CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8a04cb257c0428cced326b1cdb4ec63d7ec8a1b6f5de545c6b3a3fd2043bd4e7
MD5 50be446dc533834f84be249285b1a08a
SHA1 da7cc61216c6184b08ad8be2dbefff38cc53ec81
SHA512 3857a47d4d9ce6d2946202caa949185462a9c9ce5a6ebfc4d46f4d1131d91775fc0c7e2976d94570e1aa5247dd73e5ed091814edd77130cdb6b135fdf27df778
TLSH
T182617D4226524C17F7A8B4FCFCD91D873A34E59B04936F1218A8DC3BB87A7145E4B89C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0ef1628594e9baa4b64727e8d7cb4100e2a5c17aa8302b0bbd047e15be9d0128
MD5 2c00fea12c6ba746f316fe987b39bf4b
SHA1 6c4ed8f100051887b20b29a70d24dae8fff773d4
SHA512 db9a2ef99fe74afe98a82ef5b0ad33aa4c77ae7f8b0c60fd42d2a29fd58582e9bbc0d63a0bbffc00254966fdec8f60e3e790ae735deeb65a9a6d4f8047e969fa
TLSH
T1AD517BB6C2C5876EC81117F09729A92AED1D191A42283C16CDE9EF9FA3E24B1D10225F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 fb343c76c3738c7ec02c3a42880cf4956d76890b477c5d3c2ef9d1654b2eae79
MD5 5c0eecb8ee3d98d11c0a25922e34e1a8
SHA1 e31ae3bbd9c4be275cbf3ac25dca16ffe8714310
SHA512 7a3e575470504683be32af0c46d0c0a03a6cc5cd12bf01979eefd78d88ad8346b41c935acd2e7be25d0245676d823fe4f4641d339500bdd790667cf7c8bdb945
SSDEEP 192:sxZIlWy/fas7h9IdpdAHW6+WNGYgUYIIgrJ:sxZIMy/fas7h+OHbGW9
TLSH
T1CE12A712AE38A97B8CC7D20DBB15BF53E6F9503251941E48EAFC861C05E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 baf32fa3f55be0cbe5a5a0f3c87c9e65700b36ad9be8067177046dfd0deae352
MD5 325e16f9ec55ab5ccc30bb2a240c51c6
SHA1 4e97136d54872c04e09990fda7d57191b758702b
SHA512 7bced5057503292ee0b441f173879de0aa3b163bcdc2a3e37c185bb9172c35aaf648c400b45f68e8181f1e60c5bca2de1945d63286bb5372f74066e2f3e02691
SSDEEP 192:sxZIlWy/fasHz9IdpHAHW6+WNGYgnYIIg50J:sxZIMy/fasHz+gHbGX2
TLSH
T17722A752AE38697B8CC7E20DBB55BF53E6F9503251911E48AAFCC61C05E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 a153d821c330fdeb3199f8712ccf3597de7a2526b4f137ee47ac9939b0869300
MD5 1321beb6ab7e257657865855556a734d
SHA1 d74eb501002780cf0aef73498862d39a5a3956ad
SHA512 c2f3c98a0ce3736c25e6c0c99bef3d5e3b1441a60de2ff3ee7bf393802a69feb50f5a02a3de06e8589cf7d6dd1f115840edbace75967aa6aabfe7574f287dbbd
SSDEEP 192:sxZIlWy/fasHz9IdpdAHW6+WNGYg8YIIg50J:sxZIMy/fasHz+OHbGu2
TLSH
T1F0229511AE38697B8CC7E20DBB55BF53E6F9503251951E48AAFC861C05E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 cfdaaae79d45a2e3008856490ce08372087b17febd9c151d3205b3f3b4b33ca3
MD5 456616176edc9f30340b0e23e73422d7
SHA1 138fe2a572b3167b1655712ce33f3b5e415ff218
SHA512 7dccc4d55b3c7c04315d24352da62eee64f9e335a2b6afd7b52f6e93df5ff4590c76ea47c08fcdbf496dba489ce3c16e06d3803336c31614c657eadc9a650fb0
SSDEEP 192:sxZIlWy/fasHh9IdpdAHW6+WNGYgUYIIg5eJ:sxZIMy/fasHh+OHbGW8
TLSH
T19122B712AE38A97B8CC7D21DBB55BF53E6F9503291941E48EAFC861C05E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 28446eb2739c68efb3ef720293d9719d8aac1d93800cbae1ad59ad35efd8d3e0
MD5 1e96c9f0bd11873ccfa6c37472faed7a
SHA1 cd55fe68eba208c94b734f688c9022e768d83e16
SHA512 151454dde2f2bcdead1f0f7eb4e767359026fdcd58174edf37ede75fd12930e9653ab2ec74f1e978d2d19f72b2d07342f2c70b2d632d96fee0fc2dc7537eae8d
SSDEEP 768:gVichfPWvPZpl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXzyro4RfC:gVichfPWvPZplu1jan+LKgzp8fC
TLSH
T1E3C2FA3B640CCB7E4FC00A9DDD1A6F9B7EA802C7AA548D4047FA984C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b243f4369a6e677809f7026193952f2bc794dd78c7050a286f20c3a260ab0746
MD5 d66a5c1cfb074347ec10f2ed67c484e4
SHA1 a172efde80fa30ae03a9cb7641e1648045c444de
SHA512 1785abcc3104152cf9b6e3ecc6ef761eb4b2c5a98718a2c43e41e415232333350c62f9b40db4109389386412c570d9301973ebccbdaf61e06177c360db62d05e
SSDEEP 48:K0LuvL1ttOb9wVISrOK9715OxjeY4JbPyLFk51Hznob7+7ISNoK9t1foxt4YufcV:KU0AKtuuKWEKLCQ5yKSE6l
TLSH
T1C1910515327B120038BF259C92A187AF194235773559EA2BBFBD0065CD2FD065DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a11c4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a11c4.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 ee899c55e10d098470ac30935448131c23f158957aeceb1673bb0a1fef9d1723
MD5 fdf5031cbbaac23a4d84bf461b41fdfe
SHA1 500e3686992c2b5930494ad9cf290b1eeec63ec7
SHA512 6822a6baf508b15932c2648ea486c82ed46c51555b9e471f0f7d062ebfc6404f81a418438b8bd533eb09be8cd5fe982eb00efe2eaeb4519cb5ce7d5dbe501f26
SSDEEP 192:uuz8sNrFpQh+lphvADuQmiU14hlL4BGYX59ezkCERtZ6kH11U/5DU8:IsNrHdL5HgUBGYX5EFcZr1UU8
TLSH
T134321B35A8B8AC7B1DE3A550F4473A139FA45127DB886F94C6ED1F1C01DF29C230A92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 bfbf4a4c1d04c57cd5f15b7d6affe9c1d72cadc535d5e3667ace0ce6f97726ee
MD5 45ea4907e08bd5689f4a4df30447708b
SHA1 1dfa9b45be2edcb4ff2bb14a9527b47b39b929ea
SHA512 578e09ef5c5d08704bc8e54ed1c41a0abf5921f3c1cea1c5a0b11d327a8e0d297290767e36327e03b0b0fc10f00f6fe96e642cfb12bc39cce73c23299088675c
SSDEEP 384:0iFiZcIR0sN18TUNTUlIladL5HgUBGYX5EFcZw1U7O6R2FeokXof:PFQOswgaCuGYuFc2q7TRtc
TLSH
T149A26B729CB8987B6DE79A91F94B36039EF44077CAC5AB90D6DC6B1D00DB198130AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 046ff411bc0396c1cfa952e608601ebf4e314528ddf40072903b7c74a7e15450
MD5 826441132e15f372095856df136a909f
SHA1 bfbd826f803b980e51b9dc0e70b2a982b0dc2669
SHA512 397f20b3763e24cdfc9dedffd2436e29187e719b20ed3fe1f12c49a8b4ceba7c26cfc587fc3243dd81778b25d8217f78b9c6408bb8a4179ded305265dc01d3ef
SSDEEP 192:LJONm6DphxqQmiUy4Ms0wGYX59ezkCERtZ8kII1U/5DU6:lONm61iB0wGYX5EFcZ91UU6
TLSH
T1EB120A35E8B8AC7B1DD3A591F44735135EA8512BEB84BF50D6DC2A1C01DF65C230B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 533bf229f4ff50edeaeb428d28e7f37f43c234c6bba0ac41064e3a7355724eb7
MD5 0b88c12b03c70de3dc48569e63f9d69d
SHA1 0b8578a3014e01aecaeb51871bfa30eeefb3f980
SHA512 b5cd627357f85ed7a4790e20b90968e6b925df8275d1653bebf5977435724da70eccc11ac5e02be80590df067d49a25c3eca6c529488ba449f794f9fa8a1e856
SSDEEP 384:SZcIOsNradL5HgUBGYX5EFcZr1U7O6R2FeokXof:gOFCuGYuFcVq7TRtc
TLSH
T1C4827D71ACB86C7B28E3A151F8473A139EF8902797C96F40D5ED6B1D00DB698130BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 dab550dcd1679de97090f0e9164dbfabad303a7cc1682d893221430c40a9e3b8
MD5 ac2a4796f90c6f7654adad91bee33a24
SHA1 10f0cbcb4844923ab60dfa85371dd2ca1b2ac710
SHA512 662416bcee3feeab56174c5752d762d854eb844d0499187639e0e95d234a82981aec7831a3b2e71e6a73d64bf2b8ca14ca11295426a0e05b4d2593996a161f95
SSDEEP 192:uuz8sNrFpQh+lphvADfQmiU14hlL4BGYX59ezkCERtZ6kH11U/5DU8:IsNrHdL5YgUBGYX5EFcZr1UU8
TLSH
T16F321B35A8B8AC7B1DE3A551F44736139FA45127DB846F94C6ED1F1C01DF29C130A92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 97c022d23ce6d98cbc433039ea740c9899c3bdc39031dd17ab9c4dcc4c5726ff
MD5 d649a1a9378aac54337ef59f842047a8
SHA1 992e3e7b1741b5abc79aff98a30f0fb53b9f3549
SHA512 e9c5f93bdbd49cdce7e59d32cd6421c4549ab35aeefc3fbaf72e44d1b156112e26ec9729cbf2b8dd3adb579f3c377d099dcc95b38b13505a4f1e87fe195d498d
SSDEEP 192:LJON06DphmqQmiUy4Isq8wGYX59ezkCERnkk720MU6:lON0619RRwGYX5EFWDMU6
TLSH
T14402D735E8B8BC7B4DE3AE45B54B26135FE8202BAA956F84DAE81E1C00D764C1307937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

83c939bb-46b2-415b-9b33-3099b5ef8156.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\83c939bb-46b2-415b-9b33-3099b5ef8156.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8fc0cd4de8c3b4d895342d4331a429f063c00ba2f2059caae21e25ef27a3e674
MD5 140f0d3770d5d20045f44da6e86eee02
SHA1 d923086f120d86ef533ba2d0dfcd6b9507352dac
SHA512 57c99bff7c508ab57ddae926b0107c0386b3f4608fbeb1ad0ff926e13f4a5fcbefddd1efb232389814ea048fccda68e6df58de6e3fe72d5fb3c8bcc2e5bf2258
TLSH
T12C410959B6F91108B3B76F169BF7A86E487BBD772E06D45D11110E8F0A23A40C9B1733
MD5 SHA1 SHA512 TLSH

Submit Download